GitHub Advisoryadvisory · PyPI, npm, Maven, NuGet, Go

GHSA-m5vv-6r4h-3vj9 Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

MEDIUM Published 2024-06-11 Modified 2025-07-22 Official page ↗
Aliases
CVE-2024-35255
Ecosystem
PyPI, npm, Maven, NuGet, Go
Packages
azure-identity, @azure/identity, com.azure:azure-identity, @azure/msal-node, Microsoft.Identity.Client, github.com/Azure/azure-sdk-for-go/sdk/azidentity, com.microsoft.azure:msal4j, Azure.Identity
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-362
Reviewed
2024-06-11

Affected packages

• PyPI azure-identity: < 1.16.1 → fixed in 1.16.1 • npm @azure/identity: < 4.2.1 → fixed in 4.2.1 • Maven com.azure:azure-identity: < 1.12.2 → fixed in 1.12.2 • npm @azure/msal-node: >= 2.7.0, < 2.9.2 → fixed in 2.9.2 • NuGet Microsoft.Identity.Client: >= 4.49.1, < 4.60.4 → fixed in 4.60.4 • Go github.com/Azure/azure-sdk-for-go/sdk/azidentity: < 1.6.0-beta.4.0.20240610221955-50774cd97099 → fixed in 1.6.0-beta.4.0.20240610221955-50774cd97099 • Maven com.microsoft.azure:msal4j: >= 1.14.4-beta, < 1.15.1 → fixed in 1.15.1 • NuGet Azure.Identity: < 1.11.4 → fixed in 1.11.4 • NuGet Microsoft.Identity.Client: >= 4.61.0, < 4.61.3 → fixed in 4.61.3

Description

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.

Related

Alias · CVE (1)

  • CVE-2024-35255 Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability vulnerability

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References